---
name: mx-im
description: Safely search MX users or groups and send Midea MX / 美信 IM messages from Codex. Use when the user asks to notify someone, send a message to a person or group, use a configured group alias, @ users, @ all, or send MX file/image messages. Read lookups need no extra authorization; every live send needs explicit user authorization for that exact target and message.
---

# MX IM

Use this skill for MX / 美信 write-side interactions: user lookup, group lookup,
group alias resolution, text sends, file/image sends, @user, and @all.

## Rules

- Never print or persist raw tokens.
- Read-only lookups do not require extra authorization.
- Every live send requires explicit user authorization for the exact target and
  message in the current conversation.
- Prefer `scripts/mx_safe_send.py` for normal text sends. It dry-runs by default.
- Live text sends require both `--send` and `--confirm-user-authorized`.
- Use original `scripts/im_send.py` only for file, image, @user, @all, or push
  fields; it also requires `--confirm-user-authorized`.
- Do not read MX SQLite databases or local message cache files.

## Auth

Send scripts resolve auth in this order:

1. `MX_OC_TOKEN`.
2. `OPENCLAW_MX_SERVER_PORT` + `OPENCLAW_MX_SERVER_SECRET` from the current env.
3. The MX OpenClaw LaunchAgent plist
   `ai.midea-openclaw.gateway-stable.plist`, then `GET /oc-token` with
   `x-server-secret` to exchange a fresh OC token. Search order includes:
   `OPENCLAW_MX_LAUNCHD_PLIST`, MX's nested profile path
   `~/Library/Application Support/mx/openclaw-home/<user>/Library/LaunchAgents/`,
   all MX `openclaw-home/*/Library/LaunchAgents/` profiles, and standard
   `~/Library/LaunchAgents/`.
4. Runtime MCP config `mcporter.json`.
5. `/tmp/ua_token.txt`.
6. UA authorization flow only when explicitly running `ua_login.py` or when the
   original `im_send.py` needs a final fallback.

Never print or store the raw OC token or server secret in skill docs, repo files,
logs, or memory.

To diagnose local MX/OpenClaw token discovery without exposing the token:

```bash
python3 scripts/get_mx_oc_token.py
```

Only use `--print` or `--export` when intentionally setting a local shell env.

## Target Resolution

1. If the user gives a uid or groupId, use it directly.
2. If the user gives a group alias, resolve it first:
   ```bash
   python3 scripts/group_alias.py "<别名>"
   ```
3. If only a person name, employee id, or email prefix is given:
   ```bash
   python3 scripts/user_search.py --keyword "<姓名/工号/邮箱前缀>"
   ```
4. If only a group name is given:
   ```bash
   python3 scripts/group_search.py --keyword "<群名关键字>" --limit 5
   ```

Alias data is local-only at `references/group-aliases.local.json`; do not sync
it to repos.

## Text Send

Dry-run first:

```bash
python3 scripts/mx_safe_send.py \
  --from-id "<sender_uid>" \
  --to-id "<receiver_uid_or_group_id>" \
  --session-type p2p \
  --body "message text"
```

After explicit authorization:

```bash
python3 scripts/mx_safe_send.py \
  --from-id "<sender_uid>" \
  --to-id "<receiver_uid_or_group_id>" \
  --session-type p2p \
  --body "message text" \
  --send \
  --confirm-user-authorized
```

For detailed original script behavior, read only the relevant file in
`references/`: `mx-ua-auth.md`, `im-send.md`, `user-search.md`,
or `group-search.md`.